Method and system for managing policies in a network security system

Abstract

The present disclosure discloses method and policy management system for managing policies in network security system. The policy management system receives one or more data packets from a request source of plurality of request sources, monitors at least one of, an inbound transmission time, an out bound transmission time and a jitter hit rate associated with the one or more data packets and a hit count, a current hit count, last hit time and hit per policy associated with each of plurality of policies of network firewall in real-time. Based on monitoring, policy management system estimates a hit count percentage for each of the plurality of policies and groups plurality of policies into plurality of policy clusters based on hit count percentage associated with each of the plurality of policies. Thus, the present disclosure provides an efficient way of managing network firewall policies without any human intervention.

What is claimed is: 
     
       1. A method for managing policies in a network security system, the method comprising:
 receiving, by a policy management system associated with a network firewall, one or more data packets from a request source of a plurality of request sources; 
 performing, by the policy management system, first monitoring of an inbound transmission time, an out bound transmission time, and a jitter hit rate associated with the one or more data packets, wherein the jitter hit rate is associated with one or more data packets not delivered, or delivered with a delay to the firewall; 
 
       performing, by the policy management system, second monitoring of at least one of a hit count, a current hit count, a last hit time, and a hit per policy associated with each of a plurality of policies of the network firewall in real-time;
 estimating, by the policy management system, a hit count percentage for each of the plurality of policies based on the first monitoring and the second monitoring; and 
 grouping, by the policy management system, the plurality of policies into a plurality of policy clusters, based on the hit count percentage associated with each of the plurality of policies, to manage the policies of the network firewall, wherein grouping the plurality of policies comprises distributing computational cycle based on the hit count percentage. 
 
     
     
       2. The method as claimed in  claim 1 , wherein the hit count percentage represents number of times each policy in the plurality of policies is referenced. 
     
     
       3. The method as claimed in  claim 1 , wherein the hit count percentage is estimated based on at least one of multilinear regression and linear regression technique. 
     
     
       4. The method as claimed in  claim 1 , wherein grouping the plurality of policies further comprises:
 ranking, by the policy management system, the plurality of policies based on corresponding hit count percentage; and 
 grouping, by the policy management system, the plurality of policies into the plurality of policy clusters based on the ranking. 
 
     
     
       5. The method as claimed in  claim 4 , further comprising:
 ranking the plurality of policy clusters based on the ranking of the plurality of policies associated with each of the policy cluster. 
 
     
     
       6. The method as claimed in  claim 5 , further comprising:
 scanning, by the policy management system, upcoming data packets, using the plurality of policies in an order of the ranking of the plurality of policy clusters and an order of the ranking of the plurality of policies within each of the plurality of policy clusters. 
 
     
     
       7. The method as claimed in  claim 6 , further comprising:
 scanning the upcoming data packets with the plurality of policies associated with a policy cluster of the plurality of policy clusters ranked subsequent to a current scanning policy cluster of the plurality of policy clusters, when the upcoming data packets are passed by the current scanning policy cluster. 
 
     
     
       8. A policy management system for managing policies in a network security system, comprising:
 a processor; and 
 a memory communicatively coupled to the processor, wherein the memory stores processor instructions, which, on execution, cause the processor to:
 receive one or more data packets from a request source of a plurality of request sources; 
 perform first monitoring of an inbound transmission time, an out bound transmission time, and a jitter hit rate associated with the one or more data packets, wherein the jitter hit rate is associated with one or more data packets not delivered, or delivered with a delay to the firewall; 
 perform second monitoring of at least one of a hit count, a current hit count, a last hit time, and a hit per policy associated with each of a plurality of policies of a network firewall in real-time; 
 estimate a hit count percentage for each of the plurality of policies based on the first monitoring and the second monitoring; and 
 group the plurality of policies into a plurality of policy clusters, based on the hit count percentage associated with each of the plurality of policies, to manage the policies of the network firewall, wherein grouping the plurality of policies comprises distributing computation cycle based on the hit count percentage. 
 
 
     
     
       9. The policy management system as claimed in  claim 8 , wherein the hit count percentage represents number of times each policy in the plurality of policies is referenced. 
     
     
       10. The policy management system as claimed in  claim 8 , wherein the hit count percentage is estimated based on at least one of multilinear regression and linear regression technique. 
     
     
       11. The policy management system as claimed in  claim 8 , wherein the processor further groups the plurality of policies by:
 ranking the plurality of policies based on corresponding hit count percentage; and 
 grouping the plurality of policies into the plurality of policy clusters based on the ranking. 
 
     
     
       12. The policy management system as claimed in  claim 11 , wherein the processor ranks the plurality of policy clusters based on the ranking of the plurality of policies associated with each of the policy cluster. 
     
     
       13. The policy management system as claimed in  claim 12 , wherein the processor performs:
 scanning upcoming data packets using the plurality of policies in an order of the ranking of the plurality of policy clusters and an order of the ranking of the plurality of policies within each of the plurality of policy clusters. 
 
     
     
       14. The policy management system as claimed in  claim 13 , wherein the processor scans the upcoming data packets with the plurality of policies associated with a policy cluster of the plurality of policy clusters ranked subsequent to a current scanning policy cluster of the plurality of policy clusters, when the upcoming data packets are passed by the current scanning policy cluster. 
     
     
       15. A non-transitory computer readable medium including instructions stored thereon that when processed by at least one processor cause a policy management system to perform operations comprising:
 receiving one or more data packets from a request source of a plurality of request sources; 
 performing first monitoring of an inbound transmission time, an out bound transmission time, and a jitter hit rate associated with the one or more data packets, wherein the jitter hit rate is associated with one or more data packets not delivered, or delivered with a delay to the firewall;
 performing, by the policy management system, second monitoring of at least one of a hit count, a current hit count, a last hit time, and a hit per policy associated with each of a plurality of policies of the network firewall in real-time; 
 
 estimating a hit count percentage for each of the plurality of policies based on the first monitoring and the second monitoring; and 
 grouping the plurality of policies into a plurality of policy clusters, based on the hit count percentage associated with each of the plurality of policies, to manage the policies of the network firewall, wherein grouping the plurality of policies comprises distributing computational cycle based on the hit count percentage. 
 
     
     
       16. The medium as claimed in  claim 15 , wherein the hit count percentage represents number of times each policy in the plurality of policies is referenced. 
     
     
       17. The medium as claimed in  claim 15 , wherein the hit count percentage is estimated based on at least one of multilinear regression and linear regression technique. 
     
     
       18. The medium as claimed in  claim 15 , wherein the instructions further cause the at least one processor to group the plurality of policies by:
 ranking the plurality of policies based on corresponding hit count percentage; and 
 grouping the plurality of policies into the plurality of policy clusters based on the ranking. 
 
     
     
       19. The medium as claimed in  claim 18 , wherein the instructions cause the at least one processor to rank the plurality of policy clusters based on the ranking of the plurality of policies associated with each of the policy cluster. 
     
     
       20. The medium as claimed in  claim 19 , wherein the instructions cause the at least one processor to:
 scan upcoming data packets, using the plurality of policies in an order of the ranking of the plurality of policy clusters and an order of the ranking of the plurality of policies within each of the plurality of policy clusters. 
 
     
     
       21. The medium as claimed in  claim 20 , wherein the instructions cause the at least one processor to:
 scan the upcoming data packets with the plurality of policies associated with a policy cluster of the plurality of policy clusters ranked subsequent to a current scanning policy cluster of the plurality of policy clusters, when the upcoming data packets are passed by the current scanning policy cluster.